Fix issue 14659: intrinsic method must check if the start, end arguments are Smi.

runtime/vm/intrinsifier_arm.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_ARM.
 #if defined(TARGET_ARCH_ARM)
 
 #include "vm/intrinsifier.h"
 
 #include "vm/assembler.h"
@@ skipping 1557 matching lines @@
   // Clear hash.
   __ LoadImmediate(TMP, 0);
   __ str(TMP, FieldAddress(R0, String::hash_offset()));
   __ b(ok);
 
   __ Bind(&fail);
   __ b(failure);
 }
 
 
-// Arg0: Onebyte String
+// Arg0: OneByteString (receiver).
 // Arg1: Start index as Smi.
 // Arg2: End index as Smi.
 // The indexes must be valid.
 void Intrinsifier::OneByteString_substringUnchecked(Assembler* assembler) {
   const intptr_t kStringOffset = 2 * kWordSize;
   const intptr_t kStartIndexOffset = 1 * kWordSize;
   const intptr_t kEndIndexOffset = 0 * kWordSize;
   Label fall_through, ok;
 
   __ ldr(R2, Address(SP, kEndIndexOffset));
   __ ldr(TMP, Address(SP, kStartIndexOffset));
+  __ orr(R3, R2,  ShifterOperand(TMP));
+  __ tst(R3, ShifterOperand(kSmiTagMask));
+  __ b(&fall_through, NE);  // 'start', 'end' not Smi.
+
   __ sub(R2, R2, ShifterOperand(TMP));
   TryAllocateOnebyteString(assembler, &ok, &fall_through);
   __ Bind(&ok);
   // R0: new string as tagged pointer.
   // Copy string.
   __ ldr(R3, Address(SP, kStringOffset));
   __ ldr(R1, Address(SP, kStartIndexOffset));
   __ SmiUntag(R1);
   __ add(R3, R3, ShifterOperand(R1));
   // Calculate start address and untag (- 1).
@@ skipping 125 matching lines @@
 
 
 void Intrinsifier::TwoByteString_equality(Assembler* assembler) {
   StringEquality(assembler, kTwoByteStringCid);
 }
 
 
 }  // namespace dart
 
 #endif  // defined TARGET_ARCH_ARM